HydroSig LogoHydroSig

Security at HydroSig

At HydroSig, security is not just a feature; it's foundational to our platform and our promise to you. We are committed to protecting your data and ensuring the integrity of our services through a multi-layered security approach.

Data Protection

  • Encryption in Transit: All communications with HydroSig APIs and services are secured using TLS 1.3, ensuring your data is encrypted from your systems to ours.
  • Encryption at Rest: All customer data, including uploaded assets and generated receipts, is encrypted at rest using AES-256 encryption.
  • Secure Storage: Receipts are stored in Write-Once, Read-Many (WORM) storage, providing an immutable and tamper-proof record for auditability.

Access Control & Authentication

  • API Key Security: We enforce strong API key management practices, encouraging regular rotation and least-privilege access.
  • Role-Based Access Control (RBAC): Access to our internal systems and your data is strictly controlled through RBAC, ensuring that only authorized personnel have the necessary permissions.
  • Multi-Factor Authentication (MFA): MFA is enforced for all internal access to production systems.

Operational Security

  • Regular Security Audits: We conduct quarterly penetration tests by independent third parties and continuous vulnerability scanning to identify and remediate potential weaknesses.
  • 24/7 Monitoring & Alerting: Our systems are continuously monitored for suspicious activity, and our security team is alerted to and responds to incidents around the clock.
  • Secure Development Lifecycle: Security is integrated into every phase of our software development lifecycle, from design to deployment.
  • Incident Response Plan: We have a comprehensive incident response plan in place to effectively manage and mitigate any security incidents.

Compliance & Certifications

  • SOC 2 Type I: We are actively working towards SOC 2 Type I compliance, demonstrating our commitment to managing customer data based on the Trust Services Criteria.
  • GDPR & CCPA: Our practices are designed to comply with global data protection regulations like GDPR and CCPA. Please refer to our Privacy Notice for more details.

For any security concerns or to report a vulnerability, please contact us at security@hydrosig.com.